c7038fcad72e5f281fef43ea5d542da2c1e633f9420585bfd1875d66676967d7 | Triage™

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7038fcad72e5f281fef43ea5d542da2c1e633f9420585bfd1875d66676967d7.dll
Size 4KB
Sample221204-akfj2saa92
SHA256 c7038fcad72e5f281fef43ea5d542da2c1e633f9420585bfd1875d66676967d7
MD5 a7d1d263b61fce3b4ddd4a6080d7b2d0
SHA1 5c25012bd305fbbf2959bf7ace874b89d2f8b40d
SHA512 57c356cadc7b09d7fca7345a0e32c1461be8582aa557b48809dd2fefec8ff65f4405c4007ccc7ccf62a1f956864eee536ee14de37be75f0908398b5fa846c62a
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4644	1744	rundll32.exe	80
PID 1744 wrote to memory of 4644	1744	rundll32.exe	80
PID 1744 wrote to memory of 4644	1744	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7038fcad72e5f281fef43ea5d542da2c1e633f9420585bfd1875d66676967d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7038fcad72e5f281fef43ea5d542da2c1e633f9420585bfd1875d66676967d7.dll,#1
  2⤵
  PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads